actionview 7.0.4.2 → 7.0.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fd3f4549da2f2c74f54ac41fcbc08b23bf168e6cde6bc8fe6ed9ad638a4a868b
-  data.tar.gz: 5804c472ace4d99f3824e532f7a56800bf2b943a17ad3e13c7941b095b6190e9
+  metadata.gz: 3c5e82261a3ce6545cd9da95815e27508878283047dfa4cf62f88c8f171b44d2
+  data.tar.gz: fa0c7f1e6a1fb7e8ce87f6207f9030a91aee87024e5668b429ab24f27c092586
 SHA512:
-  metadata.gz: d3dc3ace3cc49599d3aed4c1ec0eb356ca3600b9915cde1e6337fb5575e827d4e49a6077a45394a909d36f03d4990c77f617bc7f690d8d94c9cfdca50e5bbc10
-  data.tar.gz: 94d3e1a2dc141f90df63d727efdb65bd44ba09340021a1ed1b444b13fdd617f3596258ee44a0a62c37a1e4f57d80047e07b468f4f3653e4cc7e83b8b48175fb0
+  metadata.gz: 7bea507511dc206ecaac5d6f216fa80b74d63fa6571d3ee58ef2d58dc55d306e449fc864de6500402e4dfe24bee2444668d4afa9287bff42ca8e408867d361b0
+  data.tar.gz: accb8dabd32a6b53f7fc1f2c1f05b2ae4cee32393799c9d71e2ec0a6e4b376dbebb44dac9a8b130b383cb9bc438246a2a82d37b31ed4689ca38c730b50ede2fd

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+## Rails 7.0.4.3 (March 13, 2023) ##
+
+*   Ignore certain data-* attributes in rails-ujs when element is contenteditable
+
+    [CVE-2023-23913]
+
+
 ## Rails 7.0.4.2 (January 24, 2023) ##
 
 *   No changes.

data/lib/action_view/gem_version.rb

@@ -10,7 +10,7 @@ module ActionView
     MAJOR = 7
     MINOR = 0
     TINY  = 4
-    PRE   = "2"
+    PRE   = "3"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/assets/compiled/rails-ujs.js

@@ -73,6 +73,22 @@ Released under the MIT license
         return element[expando][key] = value;
       };
 
+      Rails.isContentEditable = function(element) {
+        var isEditable;
+        isEditable = false;
+        while (true) {
+          if (element.isContentEditable) {
+            isEditable = true;
+            break;
+          }
+          element = element.parentElement;
+          if (!element) {
+            break;
+          }
+        }
+        return isEditable;
+      };
+
       Rails.$ = function(selector) {
         return Array.prototype.slice.call(document.querySelectorAll(selector));
       };
@@ -395,9 +411,9 @@ Released under the MIT license
 
     }).call(this);
     (function() {
-      var disableFormElement, disableFormElements, disableLinkElement, enableFormElement, enableFormElements, enableLinkElement, formElements, getData, isXhrRedirect, matches, setData, stopEverything;
+      var disableFormElement, disableFormElements, disableLinkElement, enableFormElement, enableFormElements, enableLinkElement, formElements, getData, isContentEditable, isXhrRedirect, matches, setData, stopEverything;
 
-      matches = Rails.matches, getData = Rails.getData, setData = Rails.setData, stopEverything = Rails.stopEverything, formElements = Rails.formElements;
+      matches = Rails.matches, getData = Rails.getData, setData = Rails.setData, stopEverything = Rails.stopEverything, formElements = Rails.formElements, isContentEditable = Rails.isContentEditable;
 
       Rails.handleDisabledElement = function(e) {
         var element;
@@ -417,6 +433,9 @@ Released under the MIT license
         } else {
           element = e;
         }
+        if (isContentEditable(element)) {
+          return;
+        }
         if (matches(element, Rails.linkDisableSelector)) {
           return enableLinkElement(element);
         } else if (matches(element, Rails.buttonDisableSelector) || matches(element, Rails.formEnableSelector)) {
@@ -429,6 +448,9 @@ Released under the MIT license
       Rails.disableElement = function(e) {
         var element;
         element = e instanceof Event ? e.target : e;
+        if (isContentEditable(element)) {
+          return;
+        }
         if (matches(element, Rails.linkDisableSelector)) {
           return disableLinkElement(element);
         } else if (matches(element, Rails.buttonDisableSelector) || matches(element, Rails.formDisableSelector)) {
@@ -513,10 +535,12 @@ Released under the MIT license
 
     }).call(this);
     (function() {
-      var stopEverything;
+      var isContentEditable, stopEverything;
 
       stopEverything = Rails.stopEverything;
 
+      isContentEditable = Rails.isContentEditable;
+
       Rails.handleMethod = function(e) {
         var csrfParam, csrfToken, form, formContent, href, link, method;
         link = this;
@@ -524,6 +548,9 @@ Released under the MIT license
         if (!method) {
           return;
         }
+        if (isContentEditable(this)) {
+          return;
+        }
         href = Rails.href(link);
         csrfToken = Rails.csrfToken();
         csrfParam = Rails.csrfParam();
@@ -545,10 +572,10 @@ Released under the MIT license
 
     }).call(this);
     (function() {
-      var ajax, fire, getData, isCrossDomain, isRemote, matches, serializeElement, setData, stopEverything,
+      var ajax, fire, getData, isContentEditable, isCrossDomain, isRemote, matches, serializeElement, setData, stopEverything,
         slice = [].slice;
 
-      matches = Rails.matches, getData = Rails.getData, setData = Rails.setData, fire = Rails.fire, stopEverything = Rails.stopEverything, ajax = Rails.ajax, isCrossDomain = Rails.isCrossDomain, serializeElement = Rails.serializeElement;
+      matches = Rails.matches, getData = Rails.getData, setData = Rails.setData, fire = Rails.fire, stopEverything = Rails.stopEverything, ajax = Rails.ajax, isCrossDomain = Rails.isCrossDomain, serializeElement = Rails.serializeElement, isContentEditable = Rails.isContentEditable;
 
       isRemote = function(element) {
         var value;
@@ -566,6 +593,10 @@ Released under the MIT license
           fire(element, 'ajax:stopped');
           return false;
         }
+        if (isContentEditable(element)) {
+          fire(element, 'ajax:stopped');
+          return false;
+        }
         withCredentials = element.getAttribute('data-with-credentials');
         dataType = element.getAttribute('data-type') || 'script';
         if (matches(element, Rails.formSubmitSelector)) {

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionview
 version: !ruby/object:Gem::Version
-  version: 7.0.4.2
+  version: 7.0.4.3
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-01-25 00:00:00.000000000 Z
+date: 2023-03-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.4.2
+        version: 7.0.4.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.4.2
+        version: 7.0.4.3
 - !ruby/object:Gem::Dependency
   name: builder
   requirement: !ruby/object:Gem::Requirement
@@ -92,28 +92,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.4.2
+        version: 7.0.4.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.4.2
+        version: 7.0.4.3
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.4.2
+        version: 7.0.4.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.4.2
+        version: 7.0.4.3
 description: Simple, battle-tested conventions and helpers for building web pages.
 email: david@loudthinking.com
 executables: []
@@ -246,10 +246,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v7.0.4.2/actionview/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v7.0.4.2/
+  changelog_uri: https://github.com/rails/rails/blob/v7.0.4.3/actionview/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v7.0.4.3/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v7.0.4.2/actionview
+  source_code_uri: https://github.com/rails/rails/tree/v7.0.4.3/actionview
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []